diff options
Diffstat (limited to 'include/fmq/MessageQueueBase.h')
-rw-r--r-- | include/fmq/MessageQueueBase.h | 56 |
1 files changed, 45 insertions, 11 deletions
diff --git a/include/fmq/MessageQueueBase.h b/include/fmq/MessageQueueBase.h index c34a4ff..f4bf7e2 100644 --- a/include/fmq/MessageQueueBase.h +++ b/include/fmq/MessageQueueBase.h @@ -586,12 +586,6 @@ void MessageQueueBase<MQDescriptorType, T, flavor>::initMemory(bool resetPointer return; } - const auto& grantors = mDesc->grantors(); - for (const auto& grantor : grantors) { - hardware::details::check(hardware::details::isAlignedToWordBoundary(grantor.offset) == true, - "Grantor offsets need to be aligned"); - } - if (flavor == kSynchronizedReadWrite) { mReadPtr = reinterpret_cast<std::atomic<uint64_t>*>( mapGrantorDescr(hardware::details::READPTRPOS)); @@ -602,11 +596,11 @@ void MessageQueueBase<MQDescriptorType, T, flavor>::initMemory(bool resetPointer */ mReadPtr = new (std::nothrow) std::atomic<uint64_t>; } - hardware::details::check(mReadPtr != nullptr, "mReadPtr is null"); + if (mReadPtr == nullptr) goto error; mWritePtr = reinterpret_cast<std::atomic<uint64_t>*>( mapGrantorDescr(hardware::details::WRITEPTRPOS)); - hardware::details::check(mWritePtr != nullptr, "mWritePtr is null"); + if (mWritePtr == nullptr) goto error; if (resetPointers) { mReadPtr->store(0, std::memory_order_release); @@ -617,14 +611,32 @@ void MessageQueueBase<MQDescriptorType, T, flavor>::initMemory(bool resetPointer } mRing = reinterpret_cast<uint8_t*>(mapGrantorDescr(hardware::details::DATAPTRPOS)); - hardware::details::check(mRing != nullptr, "mRing is null"); + if (mRing == nullptr) goto error; if (mDesc->countGrantors() > hardware::details::EVFLAGWORDPOS) { mEvFlagWord = static_cast<std::atomic<uint32_t>*>( mapGrantorDescr(hardware::details::EVFLAGWORDPOS)); - hardware::details::check(mEvFlagWord != nullptr, "mEvFlagWord is null"); + if (mEvFlagWord == nullptr) goto error; android::hardware::EventFlag::createEventFlag(mEvFlagWord, &mEventFlag); } + return; +error: + if (mReadPtr) { + if (flavor == kSynchronizedReadWrite) { + unmapGrantorDescr(mReadPtr, hardware::details::READPTRPOS); + } else { + delete mReadPtr; + } + mReadPtr = nullptr; + } + if (mWritePtr) { + unmapGrantorDescr(mWritePtr, hardware::details::WRITEPTRPOS); + mWritePtr = nullptr; + } + if (mRing) { + unmapGrantorDescr(mRing, hardware::details::EVFLAGWORDPOS); + mRing = nullptr; + } } template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor> @@ -1234,7 +1246,7 @@ bool MessageQueueBase<MQDescriptorType, T, flavor>::isValid() const { template <template <typename, MQFlavor> typename MQDescriptorType, typename T, MQFlavor flavor> void* MessageQueueBase<MQDescriptorType, T, flavor>::mapGrantorDescr(uint32_t grantorIdx) { const native_handle_t* handle = mDesc->handle(); - auto grantors = mDesc->grantors(); + const std::vector<android::hardware::GrantorDescriptor> grantors = mDesc->grantors(); if (handle == nullptr) { hardware::details::logError("mDesc->handle is null"); return nullptr; @@ -1247,10 +1259,32 @@ void* MessageQueueBase<MQDescriptorType, T, flavor>::mapGrantorDescr(uint32_t gr } int fdIndex = grantors[grantorIdx].fdIndex; + if (fdIndex < 0 || fdIndex >= handle->numFds) { + hardware::details::logError( + std::string("fdIndex (" + std::to_string(fdIndex) + ") from grantor (index " + + std::to_string(grantorIdx) + + ") must be smaller than the number of fds in the handle: " + + std::to_string(handle->numFds))); + return nullptr; + } + /* * Offset for mmap must be a multiple of PAGE_SIZE. */ + if (!hardware::details::isAlignedToWordBoundary(grantors[grantorIdx].offset)) { + hardware::details::logError("Grantor (index " + std::to_string(grantorIdx) + + ") offset needs to be aligned to word boundary but is: " + + std::to_string(grantors[grantorIdx].offset)); + return nullptr; + } + int mapOffset = (grantors[grantorIdx].offset / PAGE_SIZE) * PAGE_SIZE; + if (grantors[grantorIdx].extent < 0 || grantors[grantorIdx].extent > INT_MAX - PAGE_SIZE) { + hardware::details::logError(std::string("Grantor (index " + std::to_string(grantorIdx) + + ") extent value is too large or negative: " + + std::to_string(grantors[grantorIdx].extent))); + return nullptr; + } int mapLength = grantors[grantorIdx].offset - mapOffset + grantors[grantorIdx].extent; void* address = mmap(0, mapLength, PROT_READ | PROT_WRITE, MAP_SHARED, handle->data[fdIndex], |